Subject: Re: LKM rootkits in 2.6.x
From: Christophe Saout <christophe@saout.de>
To: Dave Jones <davej@redhat.com>
Cc: pg smith <pete@linuxbox.co.uk>, linux-kernel@vger.kernel.org
In-Reply-To: <20040311184835.GA21330@redhat.com>
References: <Pine.LNX.4.44.0403111124020.27770-100000@linuxbox.co.uk>
	 <20040311184835.GA21330@redhat.com>
Content-Type: text/plain
Message-Id: <1079032587.7517.1.camel@leto.cs.pocnet.net>
Mime-Version: 1.0
Date: Thu, 11 Mar 2004 20:16:28 +0100
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 739
Lines: 17

Am Do, den 11.03.2004 schrieb Dave Jones um 19:48:

> Don't bet on it.  They'll just start doing what binary-only driver vendors
> have been doing for months.. If the table isn't exported, they find a symbol
> that is exported, and grovel around in memory near there until they find
> something that looks like it, and patch accordingly.

Ugh... this sounds ugly. This should be forbidden. I mean, what are
things like EXPORT_SYMBOL_GPL for if drivers are allowed to patch
whatever they want?


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/